EP0635969B1

EP0635969B1 - Using an image pattern as an access key to functions of a machine

Info

Publication number: EP0635969B1
Application number: EP94305293A
Authority: EP
Inventors: Walter A.L. Johnson; D. Austin Henderson, Jr.
Original assignee: Xerox Corp
Current assignee: Xerox Corp
Priority date: 1993-07-22
Filing date: 1994-07-19
Publication date: 2000-10-11
Anticipated expiration: 2014-07-19
Also published as: US5859935A; EP0635969A3; DE69426098T2; CA2128583A1; EP0635969A2; CA2128583C; JPH0778251A; DE69426098D1

Description

The present invention relates to techniques for verifying the source of a signal, such as a signal requesting an operation.
Using PaperWorks™ on a PC., Xerox Corporation, 1992, pp. 1-4 and 71-121 describes features of PaperWorks™ software. Page 2 indicates that the software stores a document as an electronic image and that a document from a personal computer (PC) can be delivered to a fax machine, whether a document faxed to the PC or a version of a document created on the PC. Page 3 indicates that a user can set a security code and require that it be entered on forms for PaperWorks to process them.
Using PaperWorks™ from a Fax Machine., Xerox Corporation, 1992, also describes features of the PaperWorks™ software. Pages 1 and 4 indicate that information on a PC is secure because one's version of PaperWorks works only with forms created on one's PC; PaperWorks prints a special code on each form so that a document on one's PC can only be accessed with a form from one's PC. Also, for complete security, one can establish a security code to prevent unauthorized use of PaperWorks; that code must be marked on a form before PaperWorks will process it.
One aspect of the invention is based on the observation of problems with conventional source verification techniques for data processing systems. Conventionally, a data processing system verifies the source of a signal using a source verifier that includes a set of ASCII codes or other character codes, such as a password.
Conventional techniques for providing ASCII codes or other character codes to a data processing system can be problematic in certain situations. If the codes are obtained directly, such as by pressing keys of a keyboard, the system must have user input circuitry for receiving such codes; in this case, a remote user able to communicate only through a facsimile machine, for example, would have difficulty providing a source verifier. On the other hand, if the codes are obtained indirectly through handprint recognition or other recognition techniques, errors in recognition may make it difficult to provide a source verifier accurately. Such errors could occur because of inadequate recognition software or because of inadequate resolution of the facsimile transmission.
Even if a user is able to provide a set of ASCII codes or other character codes as a source verifier, the level of certainty that can be obtained with such codes is limited. It is possible for unauthorized users to observe or discover the set of codes and use them to obtain unauthorized machine operations.
EP-A-506 469 relates to an image processing apparatus comprised in a copying machine. The problem addressed in this document is the fact that present copying machines can produce copied images with extremely high quality, such that there is a demand for prevention of forgery of bills, securities and other valuable papers. According to this document, the presence of an original image conforming with a previously stored specific original is detected by a decision circuit and copying of the original image is prohibited.
JP-A-5048649 describes a mail service processing machine able to discriminate whether an incoming information sheet contains an optical mark recognition (OMR) sheet. In case an OMR sheet is not present, the deliver condition information is read out from a delivery condition table and the mail function processing means is performed in accordance with the read delivery condition information.
The object of the present invention is to provide a machine and method with an enhanced security against unauthorized operation.
Accordingly, the present invention provides a method and a machine according to the appended claims.
The first time the user provides the source verifying image, it can be stored as an original source verifying image. When the user subsequently provides the same source verifying image, it can be compared with the previously stored original source verifying image and, because it is the same, an appropriate operation can be performed that would not be performed if the images were not the same.
This technique could be implemented, for example, with a machine that can store and receive data defining images. The machine could store in memory original source verifying data defining a first source verifying image. The machine could use the original source verifying data to verify source. For example, upon receiving data defining an image that includes a second source verifying image, the machine could use the data and the original source verifying data to obtain data indicating a measure of similarity between the two images. The machine could then apply a criterion, such as a threshold, to the measure of similarity to obtain data indicating whether the second source verifying image is the same as the first source verifying image. If so, the machine could perform the appropriate operation.
A user could produce a source verifying image, for example, by marking a field of a form by hand. The user could then provide data defining an image of the marked form using a scanner or a facsimile machine, for example. The machine could use the data to obtain original source verifying data defining the source verifying image. Or the machine could use the data to determine whether the source verifying image is the same as a source verifying image defined by original source verifying data.
A form marked with a source verifying image serves a function analogous to a key: A person possessing the marked form or a sufficiently high quality copy of it can use it to obtain machine operations. The possessor of the marked form can provide it to another person to allow the other to obtain machine operations. The marked form provides more certainty in source verification than a set of codes would, because an unauthorized user cannot provide the source verifying image without having possession of the original or a high quality copy.
The techniques described above are advantageous because they make it unnecessary to employ sets of ASCII codes or other character codes as source verifiers. Instead, hand marked images can be used as source verifiers analogous to keys. The techniques are also advantageous because they make it possible for the user to provide a source verifying image that suggests a job or the content of an item of data to which it relates and that can similarly be used by a machine to identify the job or item of data in relation to which an operation is requested.
The present invention will be described further, by way of examples, with reference to the accompanying drawings, in which:-
Fig. 1 is a schematic view of a form that includes a source verifying image,
Fig. 2 is a flow chart showing general acts in using a source verifying image,
Fig. 3 is a schematic block diagram showing general components of a software product and a machine in which the software product can be used to implement the general steps in Fig. 2,
Fig. 4 is a schematic block diagram showing ways in which a human can produce a source verifying image by a hand marking operation,
Fig. 5 is a flow chart showing general acts in storing data defining an original source verifying image,
Fig. 6 is a schematic block diagram showing an item and a source verifying image stored in a database,
Fig. 7 is a schematic block diagram showing an item and a source verifying image stored in a filing system,
Fig. 8 is a flow chart showing acts in responding to data defining a purported source verifying image,
Fig. 9 is a flow chart showing acts in obtaining a measure of similarity using pixel data defining an original source verifying image and a purported source verifying image,
Fig. 10 is a schematic flow diagram of the use of a form with a source verifying image to store and retrieve a document,
Fig. 11 is a schematic flow diagram of the use of a form with a source verifying image to control a copying job,
Fig. 12 is a schematic block diagram of an application of source verifying images in a personal computer system and
Fig. 13 is a schematic block diagram of an application of source verifying images in a copier,

A. Definitions

The terms defined below have the indicated meanings throughout this application, including the claims.
An item of data indicates a "measure of similarity" between two images if the item of data has a value that indicates a degree or extent to which the two images are similar.
A first item of data is produced by "applying a criterion" to a second item of data when the first item indicates whether the second item meets the criterion. An operation that applies a criterion produces such an item of data.
A "sameness criterion" is a criterion that can be applied to an item of data indicating a measure of similarity between two images to obtain an item of data indicating whether the two images are the same. Data indicating a sameness criterion can, for example, indicate a minimum or maximum value of the measure of similarity that satisfies the criterion, or a range within which or outside which the measure of similarity satisfies the criterion.
A "source verifying image" is an image that can be used to verify a source of signals such as signals requesting operations. A signal source can be verified by using data defining two source verifying images, referred to as an "original source verifying image" and a "purported source verifying image", to determine whether the two source verifying images are the same. A measure of similarity between the purported source verifying image and the original source verifying image must meet a sameness criterion in order to verify a signal source.

B. General Features

Figs. 1-3 illustrate general features of the invention. Fig. 1 shows a form with a source verifying image. Fig. 2 shows general acts in using a source verifying image to obtain a machine operation. Fig. 3 shows general components of a software product and of a machine in which it can be used.
Fig. 1 shows form 10 with field 12 for a source verifying image as shown. Form 10 is called a key form because its function is analogous to a key. As shown, field 12 includes marks 14 made by a human by hand. A machine receiving data defining form 10 can respond by automatically storing original source verifying data defining an image of field 12 or by using data defining an image of field 12 to compare with original source verifying data to determine whether to perform an operation.
The general acts in Fig. 2 begin in box 20 by storing sameness criterion data indicating a sameness criterion. At some later time, as indicated by the first dashed line, the act in box 22 stores original source verifying (S.V.) data defining a first source verifying image, such as data defining an image of field 12 in form 10. At some yet later time, as indicated by the second dashed line, the act in box 30 receives data defining an image that shows a second source verifying image.
The act in box 32 uses the data defining the image from box 30 and the original source verifying data from box 22 to obtain data indicating a measure of similarity between the first source verifying image and the second source verifying image. Then, the act in box 34 uses the sameness criterion data from box 20 to apply the sameness criterion to the measure of similarity, obtaining data indicating whether the images are the same.
The act in box 40 branches based on the data obtained in box 34. If the data indicate that the two images are the same, the machine performs an appropriate operation, in box 42; if not, the machine does not perform the operation, in box 44.
As illustrated in Fig. 2, without a source verifying image that is sufficiently similar to the first source verifying image to satisfy the sameness criterion, a user cannot obtain the operation. Therefore, the precision of the sameness criterion determines the range of source verifying images that will be accepted as the same. For example, a very precise sameness criterion, such as a high threshold or a narrow range of similarity, might only accept a source verifying image that is the same in all respects as an original source verifying image. A less precise criterion might accept a differently scanned or differently transmitted version of the original source verifying image, which would allow for noise introduced by facsimile transmission or photocopying. A very imprecise criterion might accept a recreated version of the original source verifying image, such as a version redrawn from memory by a user. The choice of a sameness criterion therefore depends both on the desired level of precision and also on the amount of noise in the data defining the images being compared.
Fig. 3 shows software product 60, an article of manufacture that can be used in a system that includes components like those shown in Fig. 3. Software product 60 includes data storage medium 62 that can be accessed by storage medium access device 64. Data storage medium 62 could, for example, be a magnetic medium such as a set of one or more tapes, diskettes, or floppy disks; an optical medium such as a set of one or more CD-ROMs; or any other appropriate medium for storing data.
Data storage medium 62 stores data that storage medium access device 64 can provide to processor 66. Processor 66 is also connected for accessing data stored in memory 68.
Processor 66 is also connected for receiving data defining images from image input circuitry 70. The data could be obtained from facsimile (fax) machine 72; from scanner 74; from editor 76, which could be a forms editor or other interactive image editor controlled by user input devices such as a keyboard and mouse or a pen- or stylus-based input device; or from network 78, which could be a local area network or other network capable of transmitting data defining an image.
Processor 66 can also be connected for providing data defining images to image output circuitry 80. The data could in turn be provided to fax machine 82, to printer 84, to display 86, or to network 88.
In addition to data storage medium 62, software product 60 includes data stored by storage medium 62. The stored data include data indicating source verifying instructions 90, which processor 66 can execute to perform acts like those in Fig. 2. In executing instructions 90, processor 66 receives data defining a second source verifying image from image input circuitry 70. Processor 66 uses the data defining the second source verifying image and original source verifying data 92 from memory to obtain data indicating a measure of similarity between the source verifying images. Processor 66 then uses sameness criterion data 94 to apply a sameness criterion to the measure of similarity to obtain data indicating whether the images are the same. If so, processor 66 performs an appropriate operation that is not performed if the images are not the same.

C. Possible Implementations

The general features described above could be implemented in numerous ways on various machines to perform source verification.

1. Hand Marked Images

A user can provide data defining a hand marked image in many ways. Fig. 4 illustrates ways in which a user can provide a hand marked image.
In Fig. 4, several examples of hand marked images are shown at left. Image 100 was produced by hand printing, image 102 by hand writing, and image 104 by hand drawing graphics.
If the marking medium is a sheet, scanner 110 can receive a sheet holding any of the hand marked images in Fig. 4. Scanner 110 operates on the sheet to provide data defining a hand marked image to be used as a source verifying image.
If the marking medium is a marking surface of an electronic device that can sense marks, encoder 112 can receive signals from the electronic device and use the signals to obtain data defining the hand marked image. This data can then be provided to printer 114 to obtain a sheet on which marks are printed, and this sheet can be provided to scanner 110. Scanner 110 operates on the sheet to provide data defining a hand marked image to be used as a source verifying image.
Fig. 4 also shows that the data from encoder 112 could be used directly as data defining the hand marked image. This would be appropriate, for example, if the sameness criterion were very imprecise so that a user could redraw an original source verifying image from memory.
A source verifying image could be produced in any of the ways shown in Fig. 4, in a combination of the ways shown in Fig. 4, or in any other appropriate way.

2. Storing Original Source Verifying Image Data

Data defining a source verifying image and a related item of data such as a document or a job state description could be stored in various ways. Fig. 5 shows general acts in storing such data. Fig. 6 shows how an original source verifying image and a related item of data could be stored in a database. Fig. 7 shows how an original source verifying image and a related item of data could be stored in a filing system.
The act in box 130 in Fig. 5 receives a signal that includes data defining an original source verifying image and that also includes a request. The act in box 132 responds by storing data defining the original source verifying image in such a way that a purported source verifying image that is the same as the original source verifying image must be received before a related item of data can be accessed, in accordance with the request.
Fig. 6 shows entries in database 160 beginning with zeroth entry 162 and including m th entry 164. Fig. 6 also shows stored data to which m th entry 164 is linked.
As shown, m th entry 164 includes several fields. Document ID field 170 includes a pointer to item of data 172, document m. Source verifying (S.V.) image ID field 180 includes a pointer to item of data 182, data defining original source verifying image m, which a purported source verifying image must match before document m can be accessed. As a result, when data, such as from field 180, is used to access original source verifying image data, such as item of data 182, data, such as from field 170, is also available to access the related item of data, such as item of data 172.
Fig. 7 shows directory 200 listing ascii file names in a file system such as Unix, illustratively showing the zeroth name "ascii0" and the nth name "asciin". The suffix ".doc" can be annexed to the nth file name in directory 200 to access item of data 202, document n. Similarly, the suffix ".name" can be annexed to the nth file name to access item of data 204, data defining original source verifying image n, which a purported source verifying image must match before document n can be accessed. As a result, when a file name from directory 200 is used to access original source verifying image data, such as item of data 204, the file name is also available to access the related item of data, such as item of data 202.

3. Responding to Purported Source Verifying Image

A machine with stored original source verifying image data could respond to a purported source verifying image in various ways. Fig. 8 shows general acts in responding to data defining a purported source verifying image. Fig. 9 shows acts in using pixel data defining an original source verifying image and a purported source verifying image to obtain a measure of similarity.
The act in box 220 in Fig. 8 receives data defining a purported source verifying image. The act in box 222 begins a loop each iteration of which compares the purported source verifying image with an image defined by stored original source verifying image data. During each iteration, the act in box 224 obtains data indicating a measure of similarity for the next original source verifying image and the purported source verifying image from box 220.
The act in box 226 applies a criterion of sameness to the measure of similarity from box 224 to obtain data indicating whether the two images are the same. The criterion of sameness can be chosen appropriately for the measure of similarity obtained in box 224, as discussed above; for example, if the measure of similarity is a Hausdorff distance or bitmap correlation, the criterion can be a threshold that obtains a desired level of precision. The act in box 230 branches based on the data obtained in box 226. If the sameness criterion is met, the act in box 232 accesses an item of data related to the original source verifying image data that met the sameness criterion, and an appropriate operation is performed.
If an iteration of the loop is performed for each original source verifying image without meeting the criterion of sameness, the operation is not performed, as indicated in box 234.
The act in box 224 in Fig. 8 could be performed with the steps in Fig. 9.
The act in box 240 in Fig. 9 obtains data indicating a value for each pixel of the original source verifying image. This act can be performed using data defining an image that includes the source verifying image within a field, for example, in which case the pixel data indicate the values of pixels within the field. As suggested by the dashed line in Fig. 9, this act can be performed when the original source verifying image data is stored, and the pixel data can be included in the original source verifying image data. This act can also include normalization or any other operations necessary so that the same similarity measurement can be performed on a number of source verifying images. Such normalizations may be necessary, for example, to eliminate distortions introduced by a scanner or during signal transmission.
The act in box 242 is performed when data defining a purported source verifying image is received. This act obtains data indicating a value for each pixel of the purported source verifying image. This act can be performed using data defining an image that includes the purported source verifying image within a field, for example, in which case the pixel data indicate the values of pixels within the field. As in box 240, this act can also include normalization or any other operations necessary to facilitate measurement of similarity to original source verifying images.
The act in box 244 then uses the pixel data from boxes 240 and 242 to obtain data indicating a measure of similarity between the original and purported source verifying images. For example, every pixel value in the original could be compared with the purported source verifying image. Or a Hausdorff distance or other fuzzy correlation could be obtained between the two images. The use of a Hausdorff distance to compare images is described in Huttenlocher, D.P., Klanderman, G.A., and Rucklidge, W.J., "Comparing Images Using the Hausdorff Distance," Cornell University Department of Computer Science, CUCS TR 91-1211 (revised), 1991, pp. 1-35.
The sameness criterion applied in box 226 in Fig. 8 can be a threshold or other criterion appropriate to the measure of similarity obtained in box 244 in Fig. 9. For a moderately high level of precision, a sameness criterion should be chosen that allows transduction errors such as distortions introduced during scanning, but that does not allow errors introduced by tracing or reconstructing an image of the original marks in a source verifying image.

4. User Interface

Many user interface techniques could employ source verifying images. Fig. 10 shows features of a user interface for storing and retrieving documents. Fig. 11 shows features of a user interface for job control operations.
The PaperWorks™ Software described above provides a paper user interface. In other words, a user can provide input signals on paper and can receive output signals on paper. A document and an image domain document label can be stored using a form and a stored document can be retrieved using a form with a list of documents. Similarly, paper user interface techniques can employ source verifying images.
Form 260 in Fig. 10 can be used as a key to request storage and retrieval of a document. Form identification information 262 can be used by a machine to obtain a description of form 260. The description can indicate that form 260 is requesting either a store operation or a retrieve operation, as also indicated by human-readable words on form 260. The description can also indicate that field 264, labeled as containing identifying (ID) marks by human-readable words, includes a source verifying image, either an original source verifying image or a purported source verifying image.
If a machine receives data defining an image of form 260 with marks 266 in field 264, and if form 260 is followed by data defining an image of document 270, the machine can respond by automatically performing an operation that stores data defining an image of document 270. In addition, the machine can automatically store data defining an image of marks 266 so that the data defining document 270 cannot be accessed unless a purported source verifying image is received that is the same as the stored image of marks 266. Before these automatic operations, the machine can perform acts like those in Fig. 8 to determine whether marks 266 are the same as any previously stored original source verifying image; if not, the machine treats marks 266 as an original source verifying image and responds by performing the automatic operations described above.
At a later time, as indicated by the dashed line in Fig. 10, the machine again receives data defining an image of form 260 with marks 266 in field 264. The machine can respond by determining that marks 266 are the same as the original source verifying image stored when form 260 was previously received. The machine can then automatically respond by using the stored data defining document 270 to obtain data defining document 272, a version of document 270. The data defining document 272 can then be provided to an image output device.
The technique in Fig. 10 could be modified in various ways. For example, to request retrieval, a user could provide data defining a set of images. The set could include an image of form 260 as in Fig. 10, and could also include another form specifying a retrieval operation or another form with a different source verifying image in response to which the machine performs a retrieval operation.
Form 290 in Fig. 11 can similarly be used as a key to request job control operations. Form identification information 292 can be used by a machine to obtain a description of form 290. The description can indicate that form 290 is requesting a job control operation, as also indicated by human-readable words on form 290. The description can also indicate that field 294, labeled as containing identifying (ID) marks by human-readable words, includes a source verifying image, either an original source verifying image or a purported source verifying image.
The first time a machine receives data defining an image of form 290 with marks 296 in field 294, the machine can respond by automatically setting up a job. If form 290 is followed by data defining an image of document 300, the machine can respond by automatically performing an operation that stores data defining an image of document 300 as part 0, the first part of the job. As described in relation to Fig. 10, before these automatic operations, the machine can perform acts like those in Fig. 8 to determine whether marks 296 are the same as any previously stored original source verifying image.
After receiving data defining an image of document 300, when the machine again receives an image of form 290 with marks 296 in field 294, the machine can respond by automatically interrupting the job. In other words, the machine can break the job stream so that the job can later begin where it left off, allowing the user to provide the remainder of the job at later times or from one or more other scanners.
At a later time, as indicated by the first dashed line in Fig. 11, the machine again receives data defining an image of form 290 with marks 296 in field 294. The machine can respond by determining that marks 296 are the same as the original source verifying image stored when form 290 was first received. The machine can then determine that form 290 is followed by data defining an image of document 302, the nth part of the job. Each time the machine receives form 290 with marks 296 in field 294 and followed by a document, the machine can then automatically respond by again beginning the job, storing data defining an image of document 302 as part n of the job.
Some time after receiving data defining document 302, as indicated by the second dashed line in Fig. 11, the machine receives signal 304 indicating the end of a job. For example, this signal could be a signal from a paper feeder indicating no more sheets to be fed; a signal indicating the end of a facsimile transmission; or any other signal indicating the end of the job.
At a later time, as indicated by the third dashed line in Fig. 11, the machine again receives data defining an image of form 290 with marks 296 in field 294. This time, however, form 290 is not followed by a document, so that the machine determines that this is a request for retrieval of the job. The machine can then automatically respond by using the stored data defining documents 300 through 302 to obtain data defining document 310, a version that includes parts 0 through n. The data defining document 310 can then be provided to an image output device.
The technique in Fig. 11 could be modified in various ways. As in Fig. 10, a user could provide data defining a set of images requesting a retrieval operation, with the set including another form specifying a retrieval operation or including another form with a different source verifying image in response to which the machine performs a retrieval operation. Or, an operation other than retrieval could be requested, such as an operation that obtains data defining document 310 by assembling or reordering documents 300 through 302, by retrieving other information to be included in one of documents 300 through 302, by removing annotations, noise, or other extraneous information from one of documents 300 through 302, and so forth. Or a parameter of an operation could be indicated.
Fig. 11 illustrates several different uses of a form with a source verifying image. Form 290 first precedes document 300 to indicate the beginning of a new job. Form 290 then follows document 300 to indicate an interruption of the job. Form 290 then precedes document 302 to indicate an addition to the job. Form 290 could be provided in box 304 as the end of job signal. Finally, form 290 can be provided, alone or in a set of images, to request an operation to be performed on the job, such as a retrieval operation. The meaning of form 290 thus depends both on the state of the job and also on other information provided in an image set that includes it. For example, in some cases form 290 may simply represent the job, in others it may represent a process performed on the job, and in others it may represent a transition between two states of the job in which form 290 has different meanings.
Key forms 260 and 290 can be created and many copies can be made in which ID mark fields 264 and 294 are blank. Then, when a user desires an operation, the user can mark the ID mark field of a form to create an original source verifying image. Once the marked form has been used, it can subsequently be reused as a key to request a machine operation such as retrieval of a document or a job control operation for a job. If the marked form is lost, the machine operation is unavailable.

D. Possible Applications

Fig. 12 illustrates how the invention could be applied in a personal computer in a manner similar to the PaperWorks™ software product described above. Fig. 13 illustrates how the invention could be applied in a copier.
System 380 in Fig. 12 includes CPU 382, which can be the CPU of a personal computer such as an IBM PC compatible machine. CPU 382 is connected to receive user input signals from keyboard 384 and mouse 386, and can present images to a user through display 388. CPU 382 is also connected to a number of other peripheral devices, illustratively including disk drive 390, modem 392, scanner 394, and printer 396.
Program memory 400 stores operating system (OS) instructions 402, which can be a version of DOS; database instructions 404; and source verifying (S.V.) image instructions 406. Database instructions 404 and S.V. image instructions 406 could be obtained in the form of a software product stored on a floppy disk, diskette, or CD-ROM, and accessed for storage in program memory 400 by disk drive 390. Data memory 420 stores document data 422 defining documents; original S.V. image data 424 defining original source verifying images of documents; OS file names 426 for documents; and sameness criterion data 428.
System 380 can obtain items for storage in document data 422 in many ways: Data defining a document could be produced interactively by executing editing instructions (not shown), such as an image editor or a conventional word processor. Data defining a previously produced document could be retrieved from a storage medium, such as by disk drive 390. Data defining an image of a document could be obtained from scanner 394. Data defining a document in image form or in a page description language could be received from a remote location through modem 392.
Similarly, system 380 can obtain data defining a source verifying image for an item in document data 422 in several ways: A user could use scanner 394 to obtain data defining an image in which a human has made marks that are a source verifying image. Or a user could produce data defining a source verifying image elsewhere and provide it to system 380 through modem 392, such as by making a fax transmission to modem 392. The source verifying image could be provided on a form that can be used to request operations relating to data defining a document.
Sameness criterion data 428 could be obtained from an appropriately authorized user, either interactively or by retrieval from a storage medium.
S.V. image instructions 406 could be executed to obtain a measure of similarity and use sameness criterion data 428 to obtain data indicating whether the source verifying image is the same as any of the original source verifying images indicated by original S.V. image data 424. If not, database instructions 404 could be executed to store data defining the source verifying image in original S.V. image data 424 so that an operation on data defining a related document in document data 422 can only be performed if the source verifying image is matched.
If S.V. image instructions 406 instead obtain data indicating that the source verifying image is the same as one of the original source verifying images, database instructions 402 can be executed to access data defining the related document in document data 422. An appropriate operation could then be performed.
Copier 450 in Fig. 13 includes an image path defined by scanner 452, image input circuitry 454, image memory 456, image output circuitry 458, and printer 460. The manner in which data defining images are transferred along this path is controlled to an extent by CPU 470, although bandwidth along the image path can be increase with appropriate techniques that do not require concurrent operations of CPU 470, such as wideband buses, direct virtual memory access (DVMA) and other direct memory access techniques, and techniques for compressing and decompressing data defining an image. CPU 470 can receive signals from user interface circuitry 472 indicating actions of a user and can provide signals to user interface circuitry 472 to provide information to a user.
CPU 470 can execute instructions from program memory 480, including operating system (OS) instructions 482, which can be a version of DOS; database instructions 484; and source verifying (S.V.) image instructions 486. In executing, CPU 470 can access data in data memory 490, including jobs data 492 defining a queue of jobs to be performed, OS file names 494 for accessing files in image memory 456, and sameness criterion data 496.
Fig. 13 also illustrates how source verifying images could be used to control operations of copier 450. The illustrated operations include storing and retrieving data defining an image of a document to provide a copy of the document.
First, scanner 452 scans form 500, which includes form identifier 502 and source verifying image 504, and document 506. Data defining images of form 500 and document 506 are provided by image input circuitry 454 and stored in a job file in image memory 456, and CPU 470 executes database instructions 484 to set up a job in jobs data 492 and to add the job file's name to OS file names 494.
When the job reaches the head of a jobs queue defined by jobs data 492, CPU 470 executes S.V. image instructions 486 to perform image processing on the first page of the image set defined by the job file to determine whether it is a form. CPU 470 then uses form identifier 502 to obtain a description of form 500, and uses the description to obtain data defining source verifying image 504, which is stored in image memory 456. After obtaining a measure of similarity and using sameness criterion data 496 to obtain data indicating that source verifying image 504 does not match any original source verifying images previously stored in image memory 456, CPU 470 registers source verifying image 504 in jobs data 492 as an original source verifying image so that further operations cannot be performed on the job file unless data defining the same source verifying image is received.
Second, scanner 452 again scans form 500. As above, CPU 470 sets up a job and, when the job reaches the head of the jobs queue, performs image processing to obtain data defining source verifying image 504. Since source verifying image 504 is the same as the stored original source verifying image so that the criterion indicated by sameness criterion 496 is met, CPU completes this second job by causing transfer of data defining document 506 from image memory 456 to image output circuitry 458 so that printer 460 prints document 510, a copy of document 506.

E. Miscellaneous

The invention has been described in relation to implementations in which an operation is performed if a purported source verifying image matches an original source verifying image. The invention might also be implemented so that an additional criterion must be met before the operation is available. For example, the operation might be performed if the source verifying images match and if the user also provides a human-produced image. Or the operation might be performed if multiple forms are received, each with a unique form identifier and each with a purported unique source verifying image that matches an original source verifying image for the form. Or the operation might be performed only if the source verifying image match and an encoded version of the source verifying image also matches; the encoded version could be a hash encoded version.
The invention has been described in relation to implementations that obtain a measure of similarity and apply a sameness criterion. The invention could also be implemented to obtain more than one measure of similarity, with a partial sameness criterion for each measure, and with an overall sameness criterion that combines the results of the partial sameness criteria, such as by applying an OR operation or an AND operation or counting the partial sameness criteria that indicate images are the same and comparing the count with a threshold.
The invention has been described in relation to implementations that use measures of similarity such as the Hausdorff distance or another correlation. In general, however, the invention could be implemented with any suitable technique for measuring similarity between images. For example, the invention might be implemented with the technique described in U.S.-A-5,255,354.
The invention has been described in relation to implementations in which data indicating a sameness criterion are stored as a distinct item of data in data memory. In general, however, the invention could be implemented with sameness criterion data embedded in a data structure or in a procedure, whether explicit or implicit.
The invention has been described in relation to possible implementations in which source verifying image data and a stored item of data are both registered in a database, in a filing system, or in a data structure such as a lookup table so that when source verifying image data is accessed, data is also available to access a related item of data. The invention might also be implemented by including a pointer to the item of data in the source verifying image data or by any other technique making it possible to access an item of data from source verifying image data.
The invention has been described in relation to source verifying images that show marks made by a human by hand, but source verifying images could also be obtained in other ways. For example, a source verifying image could be obtained by a user by cutting and pasting together segments of images or by any other operation that produces a unique image. More generally, a source verifying image could be a non-unique image such as an image produced using a typewriter, printer, or other machine, provided that a user is able to prevent others from viewing the image long enough to recreate it.
The invention has been described in relation to possible implementations in which source verifying image data is stored so that a related item of data can be accessed for retrieval or for job control operations. The invention might also be implemented so that a related item of data can be accessed to obtain or modify information about a user's access rights or other rights relating to machine operations, such as rights to read, write, and modify stored data or rights to add, delete, or change access rights of users.
The invention has been described in relation to possible implementations with a user interface using forms. The invention might also be implemented with a user interface that does not use forms. Data defining source verifying images could be obtained independently of forms, such as from scanning operations.
The invention has been described in relation to possible implementations in which a stored item of data defines an image, such as an image of the pages of a document. The stored items of data could instead be document descriptions or process descriptions.

Claims

A machine for performing source verification so as to determine whether an operation requested by a user may be performed, comprising:

means (70, 394, 454) for providing original source verifying data (92, 424) defining an original source verifying image;

a memory device (68, 420, 490) for storing said original source verifying data (92, 424);

means (70, 394, 454) for providing image set data defining an image which is verified with respect to its similarity with the original source verifying image;

means (66, 382, 470) for comparing the original source verifying data stored in said memory device (68, 420, 490) with the image set data to obtain a similarity measure data which indicates a measure of similarity between the original source verifying image and the image to be verified;

means (66, 382, 470) for defining sameness criterion data (94, 428, 496) indicating whether two images are the same;

means for comparing the sameness criterion data (94, 428, 496) and the similarity measure data to obtain a sameness data indicating whether the original source verifying image and the image to be verified are the same;
wherein

said means (70, 394, 454) for providing the original source verifying data is adapted to process a user-created original source verifying image;

said image set data defines a purported source verifying image, and

the machine comprises means for enabling a unique operation associated with the original source verifying image if the sameness data indicates that the original source verifying image and the purported source verifying image are the same, wherein said operation would not be enabled if the images were not the same.
A method of determining whether an operation requested by a user may be performed based on whether two images are the same, comprising:

providing original source verifying data (92, 424) defining an original source verifying image;

storing said original source verifying data (92, 424);

providing image set data defining an image which is verified with respect to its similarity with the original source verifying image;

measuring the similarity between the original source verifying image and the image to be verified to obtain similarity measure data;

defining sameness criterion data (94, 428, 496) indicating whether the two images are the same;

using the sameness criterion data (94, 428, 496) and the similarity measure data to determine whether the original source verifying data and the image to be verified are the same;
wherein

said step of providing original source verifying data includes the step of processing a user-created original source verifying image and

said image set data defines a purported source verifying image; and

enabling a unique operation associated with the original source verifying image if the original source verifying image and the purported source verifying image are the same, wherein said operation would not be enabled if the images were not the same.
The method as claimed in claim 2, wherein the step of obtaining similarity measure data includes comparing said original source verifying image with said purported source verifying image.
The method as claimed in claim 2 or 3, wherein the step of determining whether the images are the same includes comparing the similarity measure data to said sameness criterion data.
The method as claimed on one of claims 2 to 4, in which the sameness criterion data indicate a threshold value.
The method as claimed in one of claims 2 to 5, in which the original source verifying image includes marks made by a human by hand.
The method as claimed in claim 6, in which the marks are made in a field of a form; the original source verifying data defining an image of the field.
The method as claimed on one of claims 2 to 7, in which the image set data include sheet image data defining an image of the sheet; further comprising the steps of:

using the sheet image data to obtain segment image data defining a segment of the image of the sheet that includes the purported source verifying image; and

using the segment image data and the original source verifying data to obtain the similarity measure data.
The method as claimed in one of claims 2 to 8, in which the original source verifying data define a plurality of original source verifying images, further comprising the steps of:

using the image set data and the original source verifying data to obtain similarity measure data for each of the original source verifying images, each original source verifying image's similarity measure data indicating a measure of similarity with the purported source verifying image.